Privacy

Broadside makes sites and products and runs outreach, paid media and lifecycle marketing on behalf of clients. That means we handle three kinds of data: yours (as a prospective or current client), your customers' (in lifecycle sequences and audience targeting we build for you), and the public contact information of people our outreach engine reaches on your behalf.

What we collect from you

• The answers you send through Start a Brief, or the contents of an email you send us.
• Account and campaign data you give us once you're a client, to run the work.
• Standard server logs (IP address, user agent, timestamp) for security and abuse prevention.

What happens to a brief you send

Start a Brief keeps your unsent answers in your own browser's local storage, so a reload doesn't lose them. Nothing leaves the page until you press Send the Brief. Sending emails your answers to the studio through Resend, our email delivery provider, with your address as the reply-to. We use them to answer that brief and for nothing else. If our mail line is not connected, the page tells you nothing was sent and hands the brief back to you to email yourself.

Audits of your website

If you ask us for an AI-visibility audit, we read your site's public homepage and send its text to AEOSearch (aeosearch.io), our own product, to work out your brand name, category, buyer and likely competitors. The audit runs only after a person here approves it. Ask us not to, and we delete it.

What our outreach engine collects

The outreach work discovers prospective creators, partners or business contacts from information those people have made public: a public social profile, a published company directory, a public press listing. We do not buy scraped consumer dossiers or leaked datasets. Anyone we contact can ask to be excluded from future contact, and we honour that across every client campaign, not only the one they replied to.

What we do with client customer data

For paid-media and lifecycle work we operate inside the ad platforms' and email and SMS providers' own data-handling terms. We don't export your customer lists to systems outside the tools you've authorised us to use, and we don't use one client's customer data to benefit another client's campaign.

Third parties

Briefs and email may be delivered through Resend. Campaign work runs through the ad and messaging platforms you authorise (for example Meta, Google, TikTok, email and SMS providers) under their own privacy terms. The films on this site are hosted here; no third-party video player loads.

Site attribution, motion and storage

If you allow attribution in the footer's Privacy Choices, this site sets a first-party cookie named bs_src for up to 30 days to record the first source, campaign tags, referral code and landing page of a visit. Attribution is off by default. Your allow or deny choice is remembered in a separate preference cookie for up to one year. The motion pause setting is kept in session storage, and an unsent brief in local storage, both in your browser only. The site also classifies known AI-crawler requests in server middleware; if a collector is configured, those crawler request details are forwarded to it.

Retention

We keep client campaign data for the length of the engagement plus a standard record-keeping period, then delete or anonymise it on request. Briefs that don't become client relationships are deleted on a routine schedule.

Contact

Questions about this policy, or a request to be excluded from outreach: support@painted.app.